Privacy Policy

1. Who we are

Symorpha ("we", "us") is a digital agency based in Pakistan. You can reach us at info@mail.symorpha.com.

This policy explains what personal data we collect when you use symorpha.com, why we collect it, where it goes, and what you can do about it.

2. What we collect and why

2.1 Site analytics (no cookies, always on)

We use Umami, a privacy-focused analytics tool, to count page views and understand which pages are useful. Umami does not use cookies, does not store your IP address, and does not identify you across sites. Because it collects no personal data, it runs without asking for consent.

2.2 Session recordings and heatmaps (only with your consent)

If you accept analytics cookies in our consent banner, we load Microsoft Clarity. Clarity records how visitors interact with pages (clicks, scrolls, mouse movement) and produces heatmaps and session replays. Clarity sets cookies and may collect your device type, browser, approximate location and the pages you visit. Form fields and text you type are masked by default.

Clarity does not load until you click "Accept" in the banner. You can withdraw consent at any time from the cookie settings link in the footer; we will stop the recording and clear Clarity's cookies. Microsoft's own privacy statement applies to the data it processes: https://privacy.microsoft.com/privacystatement

2.3 The AI assistant

Our site includes a chat assistant that helps scope projects, gives rough budget ranges, and books calls. The assistant is powered by a GLM language model provided by Z.ai (Zhipu AI). The text you type is sent to Z.ai's API to generate responses. Z.ai's terms govern their processing: https://z.ai

Please do not share sensitive personal data (health, financial account numbers, government IDs) in the chat.

If you give the assistant your name, email or phone number to request an estimate or a call, we store the chat transcript together with those details as a "lead" in our content database (see 2.5). We do this so the founder can read what you discussed before replying. If you chat without leaving contact details, the conversation is not linked to you and is not stored by us beyond the session, although Z.ai may retain API logs under their own policy.

2.4 Bookings

Calls are booked through Cal.com. When you pick a time, Cal.com collects your name, email, optional notes and timezone, and sends calendar invites. Cal.com's privacy policy applies: https://cal.com/privacy. If you arrive at the booking from the assistant, we prefill your name, email and a summary of the chat so you don't have to retype them.

2.5 Contact forms and leads

When you send a brief via the contact form, book a call, or leave details with the assistant, we store:

• your name, email and (if given) phone or WhatsApp number;
• the message, brief or chat transcript;
• which service you asked about and any budget range you selected;
• the date and the page you were on.

This is stored in Sanity, the content platform that also runs our site content. We also send ourselves a notification containing the same details by email (via Resend) and to an internal chat channel and, where you have opted in, a WhatsApp alert to the founder. These notifications are for us only; we do not add you to any marketing list.

Legal basis (where GDPR applies): performance of pre-contractual steps at your request, and our legitimate interest in responding to enquiries.

2.6 Server logs and hosting

The site is hosted on Vercel. Vercel's infrastructure processes your IP address and request headers to serve pages and to protect the site from abuse (including rate-limiting the assistant). Vercel's privacy policy: https://vercel.com/legal/privacy-policy

2.7 Email

If you become a client, we email you about your project. Transactional email is sent via Resend. We do not send newsletters unless you explicitly sign up for one, and we currently do not have one.

3. Where your data goes

Our providers are in the United States (Vercel, Sanity, Cal.com, Resend, Microsoft), the European Union or United States depending on region (Umami, self-hosted or cloud), and Singapore/China (Z.ai). By using the assistant or sending us data you understand it will be processed outside Pakistan and, if you are in the EU/UK, outside the EEA. Where required, our providers rely on standard contractual clauses or equivalent safeguards.

4. How long we keep it

Data	Retention
Umami analytics	Aggregated, indefinitely (no personal data)
Clarity recordings	Per Microsoft's retention, currently up to 30 days for recordings; heatmaps longer
Leads, briefs, chat transcripts	24 months from last contact, or until you ask us to delete them
Client project records	Duration of the engagement plus 7 years for accounting and tax purposes under Pakistani law
Booking records	Per Cal.com's policy; our copy follows the lead retention above

5. Your rights

Wherever you are, you can ask us to:

• tell you what data we hold about you;
• correct it;
• delete it (we will, unless we must keep it for tax or legal reasons);
• stop using it for a particular purpose;
• give you a copy in a portable format.

Email info@mail.symorpha.com with "Privacy request" in the subject. We respond within 30 days. If you are in the EU/UK and are not satisfied, you may complain to your local data protection authority.

6. Children

The site and services are for businesses and adults. We do not knowingly collect data from anyone under 18.

7. Security

Data is transmitted over HTTPS. Access to Sanity, Vercel and our inboxes is limited to the founder and named team members with two-factor authentication where the provider supports it. No system is perfectly secure; if we discover a breach that affects you, we will tell you without undue delay.

8. Changes

We will post changes here and update the date at the top. Material changes to how we use leads or the assistant will be flagged in the consent banner.

9. Governing law

This policy and any dispute about it are governed by the laws of the Islamic Republic of Pakistan, including the Prevention of Electronic Crimes Act 2016 and applicable data-protection legislation as enacted.